netdooka | bd59e50bd956f6ef82d05a2a9f945543cc3c4868a6916f772b6f53d51f804903

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
Size

660KB
MD5

54a315b26c66694821fb2091ef865f7f
SHA1

9f79ec5e7845bd33a58124fd3d10637a20630bb5
SHA256

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef
SHA512

625e851ddedd83103d1b27c25bdb8428e8aab9321436d48668112dd887f9ede5655b4f5b13d69e656bae522951c50cedd53426de725788ba5697089e81156814
SSDEEP

12288:nBxT3SKVIC9HdFEtttJl3Mob+60MCV94D0cIegdu1oeK/lGRgOUqmq9kR6lhKXhh:BxT3ZVB9HdFQPl3M06MCV9k0DegduieE

Score

10^/10

netdooka evasion loader persistence rat

Malware Config

Extracted

Family

netdooka

Signatures

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Avira	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Avira	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1220	sc.exe
2692	sc.exe
2712	sc.exe
2884	sc.exe
2224	sc.exe
408	sc.exe
2336	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2556	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 1968 wrote to memory of 2764	1968	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	28
PID 2764 wrote to memory of 2556	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	29
PID 2764 wrote to memory of 2556	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	29
PID 2764 wrote to memory of 2556	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	29
PID 2764 wrote to memory of 2556	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	29
PID 2764 wrote to memory of 864	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	31
PID 2764 wrote to memory of 864	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	31
PID 2764 wrote to memory of 864	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	31
PID 2764 wrote to memory of 864	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	31
PID 2764 wrote to memory of 1220	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	33
PID 2764 wrote to memory of 1220	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	33
PID 2764 wrote to memory of 1220	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	33
PID 2764 wrote to memory of 1220	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	33
PID 2764 wrote to memory of 2692	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	35
PID 2764 wrote to memory of 2692	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	35
PID 2764 wrote to memory of 2692	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	35
PID 2764 wrote to memory of 2692	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	35
PID 2764 wrote to memory of 2712	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	37
PID 2764 wrote to memory of 2712	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	37
PID 2764 wrote to memory of 2712	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	37
PID 2764 wrote to memory of 2712	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	37
PID 2764 wrote to memory of 2884	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	41
PID 2764 wrote to memory of 2884	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	41
PID 2764 wrote to memory of 2884	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	41
PID 2764 wrote to memory of 2884	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	41
PID 2764 wrote to memory of 2224	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	43
PID 2764 wrote to memory of 2224	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	43
PID 2764 wrote to memory of 2224	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	43
PID 2764 wrote to memory of 2224	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	43
PID 2764 wrote to memory of 408	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	45
PID 2764 wrote to memory of 408	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	45
PID 2764 wrote to memory of 408	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	45
PID 2764 wrote to memory of 408	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	45
PID 2764 wrote to memory of 2336	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	47
PID 2764 wrote to memory of 2336	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	47
PID 2764 wrote to memory of 2336	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	47
PID 2764 wrote to memory of 2336	2764	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	47

C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
  "C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"
  2⤵
  - Checks for any installed AV software in registry
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" 22.61.56.108 -n 4
    3⤵
    - Runs ping.exe
    PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C copy "" "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"
    3⤵
    PID:864
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create SecureElementDataSrv binpath= "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe delected"
    3⤵
    - Launches sc.exe
    PID:1220
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:2692
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:2884
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:2224
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:408
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop SecureElementDataSrv
    3⤵
    - Launches sc.exe
    PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1968-1-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/1968-8-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/1968-7-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

Filesize
4KB

Download
memory/1968-14-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1968-13-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/1968-16-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/1968-36-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/1968-35-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/1968-34-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/1968-33-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/1968-32-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/1968-31-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1968-30-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1968-29-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1968-28-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/1968-27-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1968-26-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1968-25-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/1968-37-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1968-24-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1968-23-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/1968-22-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/1968-21-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/1968-20-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/1968-19-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1968-18-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/1968-17-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1968-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1968-12-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/1968-11-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1968-10-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/1968-9-0x00000000031B0000-0x00000000031B2000-memory.dmp

Filesize
8KB

Download
memory/1968-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1968-5-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/1968-4-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/1968-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1968-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1968-39-0x000000000AC50000-0x000000000AD81000-memory.dmp

Filesize
1.2MB

Download
memory/1968-49-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1968-51-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1968-52-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2764-38-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2764-46-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-45-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2764-47-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2764-48-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2764-50-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2764-54-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-56-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2764-57-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2764-58-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download